| No. | Recommendation | Priority | Timescale | Owner | |-----|--------------------------------------------------------------------------------|----------|--------------------|--------------------------------------------| | 1 | DWP should ensure that it has a holistic strategy for corporate records management (RM) that reflects the value of information and importance of record keeping has greater profile and recognition across the organisation | high | 31/07/2015 | Knowledge and Information Management Division | | 1a | Establishing a board level senior champion for RM | high | 31/07/2015 | Knowledge and Information Management Division | | 1b | Using the senior champion for RM to promote the strategy across the organisation | high | 31/08/2015 onwards | Knowledge and Information Management Division | | 1c | Developing an implementation plan for the strategy | high | 31/07/2015 | Knowledge and Information Management Division | | 1d | Defining critical success factors for the new strategy | high | 31/07/2015 | Knowledge and Information Management Division | | | Ensuring that work to develop a new Electronic Document and Records Management System (EDRMS) solution is a core part of this | high | 31/05/2016 onwards | Collaboration Services/Knowledge and Information Management Division | |---|---|---|---|---| | 2 | DWP needs to establish concrete plans to implement a solution for managing unstructured corporate digital information to replace the print to paper policy. | | | | | 2a | Defining business requirements for RM, for example, around search, data sharing, metadata, access management and disposal, and that they guide the implementation of an EDRMS | high | 30/09/2015 | Knowledge and Information Management Division | | 2b | Collaborating and learning from the experience of other Departments that have recently rolled out EDRMS solutions. | high | 31/05/2016 onwards | Knowledge and Information Management Division/ Collaboration Services | | | Description | Priority | Date | Department | |---|-----------------------------------------------------------------------------|----------|------------|-------------------------------------------------| | 2c| A plan to identify key corporate information on the shared drives and migrate this to the new EDRMS, to freeze shared drives to new content once the EDRMS has been rolled out, and switch off the shared drives once the new system is established | high | 30/09/2016 | Knowledge and Information Management Division | | 2d| Training and supporting staff in using the new EDRMS | medium | 31/03/2016 | Knowledge and Information Management Division/ Collaboration Services | | 2e| Applying retention rules to Lync and making it clear to staff for what exact purpose they should be using this system | medium | 31/08/2015 | Technology | | 2f| Ensuring that there is a process for capturing any key corporate information from Drupal, applying retention rules, and making it clear to staff exactly what they should be using this system for | medium | 31/08/2015 | Technology | | 3 | DWP should devise a plan for embedding digital continuity (the ability to find, open, work with, understand and trust information for as long as you need to) into business as usual processes. | high | | | | | Description | Priority | Date | Department/Division | |---|-----------------------------------------------------------------------------|----------|------------|------------------------------------------| | 3a| Fully recognising and managing risks to the continuity of digital information as part of the risk management process | high | 31/08/2015 | Knowledge and Information Management Department/Information Systems Owners/ Risk Management Division | | 3b| Building digital continuity into the information asset management process as suggested in the 2011 DWP Digital Continuity Policy | medium | 31/10/2015 | Knowledge and Information Management Department | | 3c| Surveying digital information held on shared drives as part of the preparation for moving to an EDRMS. This could be done in a similar way to the paper file audits, asking business areas to report on what is held in the shared drives | high | 31/08/2015 | Knowledge and Information Management Department | | 3d| Negotiating a slot to run The National Archives’ Digital Record Object IDentification (DROID) tool, or similar, would be particularly helpful in determining how much duplicate information is held and in identifying formats and age of information. | medium | 31/08/2015 | Technology | | | Ensuring that Knowledge and Information Management Department staff are involved in any IT developments that would have an impact on Knowledge and Information Management Department responsibilities from the outset and that business requirements for IM are a core part of these projects. | medium | 31/07/2015 | Knowledge and Information Management Division | |---|---|---|---|---| | 3f | Ensuring that the need to keep information within benefits delivery systems available and usable is factored into DWP’s plan for implementing digital continuity as business as usual | medium | 31/12/2015 | to be identified | | 4 | DWP should factor information and records management into the way it defines and monitors information risk | | | | | 4a | Ensuring that the risk of not capturing and keeping the records it needs, in the way that it needs for as long as it needs, is recognised and managed through the risk management framework | high | 31/08/2015 | Knowledge and Information Management Division/Risk Management Division | | | Ensuring that information risks are discussed at Information Risk Management Board and are given scrutiny by DWP Security Oversight Board | high | 31/07/2015 | Knowledge and Information Management Division | |---|---------------------------------------------------------------------------------------------------------------------------------|------|------------|------------------------------------------------| | 4c | Promoting awareness of information risks and how they should be managed | medium | 31/12/2015 | Knowledge and Information Management Division/Risk Management Division | | 5 | DWP should seek to establish a more effective approach to monitoring and achieving compliance with IM and Records Management Policy | | | Knowledge and Information Management Division | | 5a | Establishing a network of information representatives across the organisation. This should include a role description and training and support from the Knowledge and Information Management team. | medium | 31/08/2015 | Knowledge and Information Management Division | | 5b | Using this network to promote Knowledge and Information Management policy and processes and provide training and support for staff on information and records management in business areas. | medium | 31/08/2015 onwards | Knowledge and Information Management Division | | | Building on the work that has already been done to monitor compliance with the Records Management Policy using the Information Asset Assurance returns in particular, further defining what sort of evidence business areas should provide in order to demonstrate compliance | High | 31/08/2015 | Knowledge and Information Management Division | |---|---|---|---|---| | 5d | Gaining greater assurance on the content of shared drives and the management of this content by, for example, extending file audits. | High | 30/09/2015 | Knowledge and Information Management Division | | 5e | Considering rolling out the Essential Records Management campaign of bite-sized information on information and records management across other business areas | medium | 31/12/2015 and ongoing | Knowledge and Information Management Division | | 6 | DWP should work towards extending the Knowledge and Information Management Division’s oversight and control of paper records to digital information | | | | | | Exploring the possibility of extending the paper file audits to cover digital information on the shared drives, and as part of this, ask business areas to report on disposal | medium | 31/12/2015 onwards | Knowledge and Information Management Division | |---|---|---|---|---| | 6b | Ensuring that all digital systems (including benefits delivery systems and the new EDRMS) have disposal built in and that disposal is being actioned | high | 31/12/2015 | Knowledge and Information Management Division/ System owners | | 6c | Ensuring that the Knowledge and Information Management Division/information advocates in the business are involved in the creation and management of shared drives | medium | 31/08/2015 | Knowledge and Information Management Division | | 6d | Beginning to devise an approach for appraisal, sensitivity review and transfer of digital information, particularly that on the shared drives, drawing on advice from The National Archives and other government departments’ work in this area | medium | 31/08/2015 | Knowledge and Information Management Division |